Vulnerability Intelligence · Watchlist
The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
Synced hourly · figures as of Oct 19, 2026
520 vulnerabilities · highest score first
- CVE-2018-12827High 7.5Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability.adobe · flash playerEPSS32%2 exploitsPublished Aug 29, 2018
- CVE-2018-11235High 7.8In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur.gitforwindows · gitEPSS48%1 exploitPublished May 30, 2018
- CVE-2017-8682High 8.8Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, Windows Server 2016, Microsoft Office Word Viewer, Microsoft Office 2007 Service Pack 3 , and…microsoft · office 2007EPSS50%2 exploitsPublished Sep 12, 2017
- CVE-2017-2935High 8.8flash-plugin: multiple code execution issues fixed in APSB17-02adobe · flash playerEPSS30%2 exploitsPublished Jan 10, 2017
- CVE-2017-2934High 8.8flash-plugin: multiple code execution issues fixed in APSB17-02adobe · flash playerEPSS30%2 exploitsPublished Jan 10, 2017
- CVE-2017-2933High 8.8flash-plugin: multiple code execution issues fixed in APSB17-02adobe · flash playerEPSS30%2 exploitsPublished Jan 10, 2017
- CVE-2017-11793High 7.5Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current…microsoft · internet explorerEPSS50%2 exploitsPublished Oct 13, 2017
- CVE-2016-0736High 7.5In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption.apache · http serverEPSS49%1 exploitPublished Jul 27, 2017
- CVE-2016-0015High 7.8DirectShow in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted file, aka "DirectShow Heap…microsoft · windows 10EPSS49%2 exploitsPublished Jan 13, 2016
- CVE-2015-3302High 7.5TheCartPress eCommerce Shopping Cart <= 1.5.3.6 - Sensitive Information Disclosurethecartpress · thecartpress ecommerce shopping cartEPSS22%3 exploitsPublished Apr 28, 2015
- CVE-2014-9734High 7.5Slider Revolution <= 4.1.4 - Directory Traversalthemepunch · slider revolutionEPSS20%4 exploitsPublished Dec 16, 2014
- CVE-2012-2110High 7.5The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory…openssl · opensslEPSS48%1 exploitPublished Apr 19, 2012
- CVE-2005-4832High 7.5SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2) SYS.DBMS_CDC_ISUBSCRIBE packages, a different…oracle · oracle10gEPSS43%4 exploitsPublished Dec 31, 2005
- CVE-2004-0213High 7.8Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly…microsoft · windows 2000EPSS20%4 exploitsPublished Aug 6, 2004
- CVE-2004-0121High 7.5Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs.microsoft · outlookEPSS48%1 exploitPublished Apr 15, 2004
- CVE-2026-54121High 8.8Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.microsoft · windows 10 1607EPSS0.8%10 exploitsPublished Jul 14, 2026
- CVE-2025-68664High 8.2LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIslangchain · langchain coreEPSS43%1 exploitPublished Dec 23, 2025
- CVE-2024-54146High 8.8Cacti has a SQL injection vulnerability in the template function of host_templates.php using the graph_template parameter.cacti · cactiEPSS46%1 exploitPublished Jan 27, 2025
- CVE-2024-25415High 7.2A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php.phoenixcart · ce phoenix cartEPSS27%3 exploitsPublished Feb 15, 2024
- CVE-2023-44466High 8.8There is an integer signedness error, leading to a buffer overflow and remote code execution via HELLO or one of the AUTH frames.linux · linux kernelEPSS46%1 exploitPublished Sep 29, 2023
- CVE-2023-27159High 7.5Appwrite Server-Side Request Forgery vulnerabilityappwrite · appwriteEPSS36%2 exploitsPublished Mar 31, 2023
- CVE-2021-29440High 7.2Grav's Twig processing allowing dangerous PHP functions by defaultgetgrav · gravEPSS30%2 exploitsPublished Apr 16, 2021
- CVE-2021-21974High 8.8OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability.vmware · cloud foundationEPSS45%Ransomware1 exploit1 actorPublished Feb 8, 2023
- CVE-2020-14209High 8.8Dolibarr Unrestricted Upload of File with Dangerous Typedolibarr · dolibarrEPSS27%2 exploitsPublished May 24, 2022
- CVE-2019-6225High 7.8A memory corruption issue was addressed with improved validation.apple · tvosEPSS29%2 exploitsPublished Mar 5, 2019
- CVE-2019-16405High 7.2Improper Input Validation in Centreon Webcentreon · centreon webEPSS27%2 exploitsPublished Jul 28, 2021
- CVE-2019-13024High 8.8Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it…centreon · centreonEPSS32%4 exploitsPublished Jul 1, 2019
- CVE-2019-11932High 8.8android-gif-drawable Double Free vulnerabilityandroid-gif-drawable project · android-gif-drawableEPSS45%1 exploitPublished May 24, 2022
- CVE-2018-8474High 7.5A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages, aka "Lync for Mac 2011 Security Feature Bypass Vulnerability." This affects Microsoft Lync.microsoft · lync for macEPSS38%2 exploitsPublished Sep 12, 2018
- CVE-2018-7182High 7.5The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10.ntp · ntpEPSS29%2 exploitsPublished Mar 6, 2018
- CVE-2018-4937High 8.8Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability.adobe · flash playerEPSS26%2 exploitsPublished May 19, 2018
- CVE-2018-4935High 8.8Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability.adobe · flash playerEPSS26%2 exploitsPublished May 19, 2018
- CVE-2017-8558High 7.8The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on 32-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703…microsoft · endpoint protectionEPSS44%1 exploitPublished Jun 29, 2017
- CVE-2017-16642High 7.5php: Out-of-bound read in timelib_meridian()php · phpEPSS26%2 exploitsPublished Nov 7, 2017
- CVE-2016-1011High 8.8flash-plugin: multiple code execution issues fixed in APSB16-10adobe · flash playerEPSS26%2 exploitsPublished Apr 7, 2016
- CVE-2016-1001High 8.8flash-plugin: multiple code execution issues fixed in APSB16-08adobe · airEPSS25%2 exploitsPublished Mar 10, 2016
- CVE-2016-1000High 8.8flash-plugin: multiple code execution issues fixed in APSB16-08adobe · airEPSS29%2 exploitsPublished Mar 10, 2016
- CVE-2016-0999High 8.8flash-plugin: multiple code execution issues fixed in APSB16-08adobe · airEPSS29%2 exploitsPublished Mar 10, 2016
- CVE-2016-0997High 8.8flash-plugin: multiple code execution issues fixed in APSB16-08adobe · airEPSS29%2 exploitsPublished Mar 10, 2016
- CVE-2016-0985High 8.8flash-plugin: multiple code execution issues fixed in APSB16-04adobe · air sdkEPSS26%2 exploitsPublished Feb 9, 2016
- CVE-2014-1912High 7.5Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.python · pythonEPSS28%2 exploitsPublished Mar 1, 2014
- CVE-2009-1699High 7.5The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as…apple · safariEPSS29%2 exploitsPublished Jun 10, 2009
- CVE-2008-0387High 7.8Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote attackers to execute arbitrary code via crafted (1) op_receive, (2) op_start, (3) op_start_and_receive, (4) op_send, (5) op_start_and_send,…firebirdsql · firebirdEPSS46%1 exploitPublished Jan 29, 2008
- CVE-2005-0048High 7.5Microsoft Windows XP SP2 and earlier, 2000 SP3 and SP4, Server 2003, and older operating systems allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IP packets with malformed options, aka the "IP Validation Vulnerability."microsoft · windows xpEPSS39%3 exploitsPublished May 2, 2005
- CVE-2003-0107High 7.5Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnprintf, allows attackers to cause a denial of service or possibly execute arbitrary code.zlib · zlibEPSS26%2 exploitsPublished Mar 7, 2003
- CVE-2026-98260High 7.8exec: Cleanup POSIX timers right after de_thread()linux · linux kernelEPSS0.1%2 exploitsPublished Oct 6, 2026
- CVE-2026-92392High 8.1HTTP/2 upload Use-After-Freemicrosoft · azl3 mysql 8.0.46-2EPSS0.6%1 exploitPublished Oct 14, 2026
- CVE-2023-5150High 8.8UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in D-Link DAR-7000 and DAR-8000 up to 20151231.dlink · dar-7000 firmwareEPSS23%2 exploitsPublished Sep 25, 2023
- CVE-2023-4168High 7.5It has been classified as problematic.templatecookie · adlistingEPSS46%2 exploitsPublished Aug 5, 2023
- CVE-2023-24709High 7.5An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and login.xml parameters.paradox · ipr512 firmwareEPSS44%3 exploitsPublished Mar 21, 2023
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-12827 | Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. adobe · flash player | High 7.5 | 32% | 2 exploits | |
| CVE-2018-11235 | In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. gitforwindows · git | High 7.8 | 48% | 1 exploit | |
| CVE-2017-8682 | Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, Windows Server 2016, Microsoft Office Word Viewer, Microsoft Office 2007 Service Pack 3 , and… microsoft · office 2007 | High 8.8 | 50% | 2 exploits | |
| CVE-2017-2935 | flash-plugin: multiple code execution issues fixed in APSB17-02 adobe · flash player | High 8.8 | 30% | 2 exploits | |
| CVE-2017-2934 | flash-plugin: multiple code execution issues fixed in APSB17-02 adobe · flash player | High 8.8 | 30% | 2 exploits | |
| CVE-2017-2933 | flash-plugin: multiple code execution issues fixed in APSB17-02 adobe · flash player | High 8.8 | 30% | 2 exploits | |
| CVE-2017-11793 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current… microsoft · internet explorer | High 7.5 | 50% | 2 exploits | |
| CVE-2016-0736 | In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. apache · http server | High 7.5 | 49% | 1 exploit | |
| CVE-2016-0015 | DirectShow in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted file, aka "DirectShow Heap… microsoft · windows 10 | High 7.8 | 49% | 2 exploits | |
| CVE-2015-3302 | TheCartPress eCommerce Shopping Cart <= 1.5.3.6 - Sensitive Information Disclosure thecartpress · thecartpress ecommerce shopping cart | High 7.5 | 22% | 3 exploits | |
| CVE-2014-9734 | Slider Revolution <= 4.1.4 - Directory Traversal themepunch · slider revolution | High 7.5 | 20% | 4 exploits | |
| CVE-2012-2110 | The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory… openssl · openssl | High 7.5 | 48% | 1 exploit | |
| CVE-2005-4832 | SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2) SYS.DBMS_CDC_ISUBSCRIBE packages, a different… oracle · oracle10g | High 7.5 | 43% | 4 exploits | |
| CVE-2004-0213 | Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly… microsoft · windows 2000 | High 7.8 | 20% | 4 exploits | |
| CVE-2004-0121 | Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs. microsoft · outlook | High 7.5 | 48% | 1 exploit | |
| CVE-2026-54121 | Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network. microsoft · windows 10 1607 | High 8.8 | 0.8% | 10 exploits | |
| CVE-2025-68664 | LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs langchain · langchain core | High 8.2 | 43% | 1 exploit | |
| CVE-2024-54146 | Cacti has a SQL injection vulnerability in the template function of host_templates.php using the graph_template parameter. cacti · cacti | High 8.8 | 46% | 1 exploit | |
| CVE-2024-25415 | A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php. phoenixcart · ce phoenix cart | High 7.2 | 27% | 3 exploits | |
| CVE-2023-44466 | There is an integer signedness error, leading to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. linux · linux kernel | High 8.8 | 46% | 1 exploit | |
| CVE-2023-27159 | Appwrite Server-Side Request Forgery vulnerability appwrite · appwrite | High 7.5 | 36% | 2 exploits | |
| CVE-2021-29440 | Grav's Twig processing allowing dangerous PHP functions by default getgrav · grav | High 7.2 | 30% | 2 exploits | |
| CVE-2021-21974 | OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. vmware · cloud foundation | High 8.8 | 45% | Ransomware1 exploit1 actor | |
| CVE-2020-14209 | Dolibarr Unrestricted Upload of File with Dangerous Type dolibarr · dolibarr | High 8.8 | 27% | 2 exploits | |
| CVE-2019-6225 | A memory corruption issue was addressed with improved validation. apple · tvos | High 7.8 | 29% | 2 exploits | |
| CVE-2019-16405 | Improper Input Validation in Centreon Web centreon · centreon web | High 7.2 | 27% | 2 exploits | |
| CVE-2019-13024 | Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it… centreon · centreon | High 8.8 | 32% | 4 exploits | |
| CVE-2019-11932 | android-gif-drawable Double Free vulnerability android-gif-drawable project · android-gif-drawable | High 8.8 | 45% | 1 exploit | |
| CVE-2018-8474 | A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages, aka "Lync for Mac 2011 Security Feature Bypass Vulnerability." This affects Microsoft Lync. microsoft · lync for mac | High 7.5 | 38% | 2 exploits | |
| CVE-2018-7182 | The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10. ntp · ntp | High 7.5 | 29% | 2 exploits | |
| CVE-2018-4937 | Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. adobe · flash player | High 8.8 | 26% | 2 exploits | |
| CVE-2018-4935 | Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. adobe · flash player | High 8.8 | 26% | 2 exploits | |
| CVE-2017-8558 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on 32-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703… microsoft · endpoint protection | High 7.8 | 44% | 1 exploit | |
| CVE-2017-16642 | php: Out-of-bound read in timelib_meridian() php · php | High 7.5 | 26% | 2 exploits | |
| CVE-2016-1011 | flash-plugin: multiple code execution issues fixed in APSB16-10 adobe · flash player | High 8.8 | 26% | 2 exploits | |
| CVE-2016-1001 | flash-plugin: multiple code execution issues fixed in APSB16-08 adobe · air | High 8.8 | 25% | 2 exploits | |
| CVE-2016-1000 | flash-plugin: multiple code execution issues fixed in APSB16-08 adobe · air | High 8.8 | 29% | 2 exploits | |
| CVE-2016-0999 | flash-plugin: multiple code execution issues fixed in APSB16-08 adobe · air | High 8.8 | 29% | 2 exploits | |
| CVE-2016-0997 | flash-plugin: multiple code execution issues fixed in APSB16-08 adobe · air | High 8.8 | 29% | 2 exploits | |
| CVE-2016-0985 | flash-plugin: multiple code execution issues fixed in APSB16-04 adobe · air sdk | High 8.8 | 26% | 2 exploits | |
| CVE-2014-1912 | Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string. python · python | High 7.5 | 28% | 2 exploits | |
| CVE-2009-1699 | The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as… apple · safari | High 7.5 | 29% | 2 exploits | |
| CVE-2008-0387 | Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote attackers to execute arbitrary code via crafted (1) op_receive, (2) op_start, (3) op_start_and_receive, (4) op_send, (5) op_start_and_send,… firebirdsql · firebird | High 7.8 | 46% | 1 exploit | |
| CVE-2005-0048 | Microsoft Windows XP SP2 and earlier, 2000 SP3 and SP4, Server 2003, and older operating systems allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IP packets with malformed options, aka the "IP Validation Vulnerability." microsoft · windows xp | High 7.5 | 39% | 3 exploits | |
| CVE-2003-0107 | Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnprintf, allows attackers to cause a denial of service or possibly execute arbitrary code. zlib · zlib | High 7.5 | 26% | 2 exploits | |
| CVE-2026-98260 | exec: Cleanup POSIX timers right after de_thread() linux · linux kernel | High 7.8 | 0.1% | 2 exploits | |
| CVE-2026-92392 | HTTP/2 upload Use-After-Free microsoft · azl3 mysql 8.0.46-2 | High 8.1 | 0.6% | 1 exploit | |
| CVE-2023-5150 | UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. dlink · dar-7000 firmware | High 8.8 | 23% | 2 exploits | |
| CVE-2023-4168 | It has been classified as problematic. templatecookie · adlisting | High 7.5 | 46% | 2 exploits | |
| CVE-2023-24709 | An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and login.xml parameters. paradox · ipr512 firmware | High 7.5 | 44% | 3 exploits |
Showing 51–100 of 520
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.